Open-Weight vs Open-Source AI Models: The Difference That Bites (2026)

Open-weight means you can download the model's weights. Open-source means you get the four freedoms to use, study, modify, and share it. In 2026, almost every frontier-adjacent release (DeepSeek, Kimi K3, Llama 4) is the former dressed as the latter, and the difference surfaces exactly once: when you scale.

Key takeaways

• "Open weight" has no agreed legal definition; "open source" does: the OSI's Open Source AI Definition 1.0, built on 4 freedoms: use, study, modify, share.
• 3 of the biggest recent releases (Llama 4, Kimi K3, and pre-2026 Gemma generations) show how custom licenses attach conditions that trigger at scale, by geography, or on redistribution.
• Meta's Llama 4 license carves the EU out of multimodal use and keeps a 700 million monthly-active-user threshold above which you need a separate deal with Meta.
• Gemma 4's move to Apache 2.0 makes it the simplest commercial "yes" among 2026's major releases.
• The one number most custom licenses care about is your monthly active users — know yours before legal asks.

What does "open weight" actually mean?

A model's weights are the learned parameter files — the thing you download from Hugging Face, load into vLLM or llama.cpp, and run on hardware you control. When a lab says a model is "open weight," it is describing a distribution mechanism: the files are public. It is not describing a set of rights.

That distinction matters because the rights you actually get live entirely in the license text attached to those files, and "open weight" has no standards body, no definition, and no floor. Two models can both be marketed as open-weight while giving you wildly different freedom: one under MIT, one under a multi-thousand-word custom agreement with user thresholds, naming duties, and regional carve-outs. The download button looks identical in both cases.

So treat "open weight" as a starting signal, not an answer. It tells you that you can self-host, quantize, and (usually) fine-tune. It tells you nothing about whether you may do those things commercially, in your jurisdiction, at your scale.

What does "open source" actually mean?

"Open source" does have a definition. The Open Source Initiative, which has stewarded the Open Source Definition for software since 1998, released the Open Source AI Definition (OSAID) 1.0 in October 2024. It applies the classic four freedoms to AI systems: anyone may use the system for any purpose without permission, study how it works, modify it for any purpose, and share it with or without modifications.

The teeth are in the study freedom. The OSAID requires disclosure of sufficiently detailed information about the training data that a skilled person could build a substantially equivalent system. Almost no frontier-adjacent lab does this. That means that under the strict definition, even models with OSI-approved licenses on their weights (DeepSeek under MIT, Gemma 4 under Apache 2.0) fall short, because their training data remains undisclosed.

Practitioners mostly use a looser reading: weights under a recognized OSI-approved license (MIT, Apache 2.0) count as open source. Lawyers, standards folks, and the OSI itself use the strict one. Both positions are defensible. What is not defensible is using "open source" to describe a model under a bespoke license with commercial conditions, which is exactly what much of 2026's release marketing does.

Why the difference bites later

The gap between the two terms is invisible on day one. You download the weights, run a demo, ship a feature. Nobody asks for the license file. The conditions in custom licenses are written to activate later, at four specific moments:

1. Scale. Threshold clauses key off your monthly active users or revenue. Cross the line and you owe the lab a conversation, and possibly a negotiated license.
2. Acquisition or diligence. An acquirer's counsel will read every model license in your stack. Ambiguous redistribution or derivative terms get priced into the deal, or flagged as a blocker.
3. Geography. Regional carve-outs sleep until you expand into the carved-out region, or hire a team there.
4. Redistribution and derivatives. Ship a fine-tune or distill a smaller model, and naming, attribution, and derivative-licensing clauses wake up.

None of these are hypothetical. They are the actual mechanics of the licenses behind the biggest open releases of the past two years.

What are the Llama 4 license's EU restrictions?

Meta's Llama 4 Community License contains the most-discussed carve-out in recent releases: for the multimodal Llama 4 models, the license rights are not granted to you if you are an individual domiciled in, or a company with a principal place of business in, the European Union. The text-only models remain available to EU builders; the multimodal ones do not. The clause is widely read as Meta limiting its exposure to EU AI regulation. That is an interpretation, not a verified motive, but it is consistent with Meta's public complaints about regulatory unpredictability in the bloc.

Two more Llama conditions practitioners trip over:

• The 700 million MAU clause. Carried across Llama versions, it requires any entity whose products or services had more than 700 million monthly active users on the release date to request a separate license from Meta. Irrelevant for a startup; very relevant if you are building on top of a platform that already has scale.
• Attribution and derivative naming. Distribute Llama 4 or a derivative and you must display "Built with Llama," and derivative model names must begin with "Llama." Fine-tunes you ship to customers are distributions.

These terms attach to you, not to your infrastructure. Running Llama 4 through a US-hosted third-party API does not change where your company is domiciled.

Kimi K3 license explained

Moonshot AI ships Kimi K3 under a custom license, not a standard OSI-approved text. That single fact should change how you evaluate it: there is no pre-existing legal playbook, and the launch blog post is not the binding document; the license file on the model card is.

There is precedent for Moonshot adding conditions to otherwise permissive text: Kimi K2 used a modified MIT license that attached an attribution requirement for very large commercial deployments. Kimi K3's terms are their own document, so do not assume the K2 terms carry over in either direction. Before a commercial deployment, read the full license and check specifically for:

• The scope of permitted commercial use
• Any scale thresholds (monthly active users or revenue)
• Naming or attribution duties for products and derivatives
• Redistribution and fine-tune terms
• Termination and change-of-terms language

Once the license is cleared, the operational side is the easy part. Our Kimi K3 API run guide covers endpoints and setup.

Gemma 4 and the Apache 2.0 reset

The sharpest contrast in 2026 comes from Google. Earlier Gemma generations shipped under a custom Gemma Terms of Use: workable, but another bespoke document for counsel to parse. Gemma 4 ships under Apache 2.0, the same license as Kubernetes and Kafka.

That matters more than it sounds. Apache 2.0 is OSI-approved, includes an express patent grant, and imposes no user thresholds, no geography clauses, and no naming duties. Every corporate legal department on earth already has a playbook for it. Under the strict OSAID, Gemma 4 still isn't fully "open source" (training-data disclosure remains the sticking point there), but as a pure license question it is the cleanest commercial "yes" among 2026's major releases. Boring licenses are a feature.

Is DeepSeek open source?

Under the loose, license-based reading: yes. DeepSeek's recent flagship weights ship under the MIT license, per the DeepSeek model cards. MIT permits commercial use, modification, and redistribution with only a copyright-notice obligation. Under the strict OSAID: no, because the training data is not disclosed. For most builders the practical answer is the first one; just know which definition your legal team is using before you put "open source" in a slide deck.

Can you use open models commercially? A 60-second checklist

Usually yes, but verify, don't assume. For every model in your stack:

1. Open the license file on the model card. Not the announcement post, not a news article. The license text is the only binding document.
2. Classify it. MIT or Apache 2.0 → proceed with standard obligations. Anything custom → read every clause.
3. Scan for the four traps: scale thresholds, geography carve-outs, naming/attribution duties, redistribution and derivative terms.
4. Check the version history. Licenses change between generations: Gemma went custom → Apache 2.0; DeepSeek's line went custom → MIT. Never inherit assumptions from a model's predecessor.
5. Log the license in your model registry alongside the evals. Our model tracker lists license families for current releases if you need a starting point.
6. Escalate to counsel whenever the license is custom and you expect real scale, EU operations, or redistribution. That combination is where every trap lives.

The license follows the weights

One last practitioner point: license terms are orthogonal to infrastructure. Whether you self-host, call the lab's own API, use a third-party serverless inference provider, or route through a decentralized inference marketplace such as Morpheus, the same license travels with the model. Running Llama 4 behind someone else's endpoint does not launder the EU carve-out, and running Kimi K3 on your own GPUs does not mute a naming clause. Choose your license posture and your infrastructure posture deliberately. They are separate decisions that both belong in writing.

FAQ

Is DeepSeek open source? DeepSeek's recent flagship weights ship under the OSI-approved MIT license, so commercial use, modification, and redistribution are permitted. Under the OSI's stricter Open Source AI Definition, which expects training-data transparency, it falls short. The data is not disclosed.

What are the Llama 4 license's EU restrictions? Meta's Llama 4 Community License does not grant rights to the multimodal Llama 4 models to individuals domiciled in, or companies with a principal place of business in, the European Union. Text-only models remain available; EU teams deploying multimodal should get legal review.

Kimi K3 license explained — what should you check? Kimi K3 ships under a custom Moonshot AI license rather than a standard OSI-approved text. Custom licenses can attach conditions to scale, naming, or redistribution, so read the full license on the model card before commercial deployment. The blog post is not the license.

Can I use open models commercially? Usually yes. Models under Apache 2.0 or MIT (Gemma 4, DeepSeek) permit commercial use outright. Custom licenses (Llama 4, Kimi K3) permit it with conditions such as scale thresholds, attribution, or regional carve-outs. The binding answer is in the license text, not the launch post.